<html>
<head><meta charset="utf-8"><title>reading uninit memory *is* ub right? · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html">reading uninit memory *is* ub right?</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="162284370"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162284370" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162284370">(Apr 01 2019 at 22:16)</a>:</h4>
<p>Reading unitialized memory (as in <code>let x = Vec::with_capacity(128); x.set_len(128); println!("{:?}", x)</code>) <em>is</em> UB, right? I’m not going crazy, <em>right</em>?</p>



<a name="162284577"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162284577" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162284577">(Apr 01 2019 at 22:21)</a>:</h4>
<p>/me sanity checks self with miri</p>



<a name="162291137"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162291137" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Daniel Carosone <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162291137">(Apr 02 2019 at 00:11)</a>:</h4>
<p>sure looks like it</p>



<a name="162296697"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162296697" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162296697">(Apr 02 2019 at 02:06)</a>:</h4>
<p>It would be "fun" to see what would bee true in a world where that's somehow not UB.</p>



<a name="162334920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162334920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162334920">(Apr 02 2019 at 13:42)</a>:</h4>
<blockquote>
<p>Reading unitialized memory (as in <code>let x = Vec::with_capacity(128); x.set_len(128); println!("{:?}", x)</code>) <em>is</em> UB, right? I’m not going crazy, <em>right</em>?</p>
</blockquote>
<p>I couldn't even get it to compile without putting <code>x.set_len()</code> inside of an <code>unsafe</code> block,  so this is my version:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span>: <span class="nb">Vec</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="nb">Vec</span>::<span class="n">with_capacity</span><span class="p">(</span><span class="mi">128</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="n">x</span><span class="p">.</span><span class="n">set_len</span><span class="p">(</span><span class="mi">128</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>
<span class="w">    </span><span class="n">println</span><span class="o">!</span><span class="p">(</span><span class="s">&quot;{:?}&quot;</span><span class="p">,</span><span class="w"> </span><span class="n">x</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>And even then, the output under either debug or release profiles is always</p>
<div class="codehilite"><pre><span></span>[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
</pre></div>


<p>So I'd say that it is technically UB, but someone thought to use <code>calloc()</code> or something similar underneath it all (at least on Ubuntu 18.04.2 LTS, rustc 1.33.0 (2aa4c46cf 2019-02-28)) so the behavior is well-defined by accident at least... <span aria-label="thinking" class="emoji emoji-1f914" role="img" title="thinking">:thinking:</span></p>



<a name="162335725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162335725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162335725">(Apr 02 2019 at 13:51)</a>:</h4>
<p>I don't think it's using calloc. It just happens to be the first use of this part of memory in that process, and linux zeroes pages before handing them out to processes.</p>



<a name="162335915"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162335915" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162335915">(Apr 02 2019 at 13:53)</a>:</h4>
<p>You're probably right about that, I haven't dug into the code to check.  That said, the docs <strong>do not</strong> make any promises about initializing memory, so even if it just happens to work out that the memory is always initialized, it is still UB.</p>



<a name="162336202"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336202" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336202">(Apr 02 2019 at 13:56)</a>:</h4>
<p>For example:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">main</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span>: <span class="nb">Vec</span><span class="o">&lt;</span><span class="kt">u8</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="mi">0</span><span class="p">..).</span><span class="n">take</span><span class="p">(</span><span class="mi">128</span><span class="p">).</span><span class="n">collect</span><span class="p">();</span><span class="w"></span>
<span class="w">    </span><span class="n">x</span><span class="p">.</span><span class="n">clear</span><span class="p">();</span><span class="w"></span>

<span class="w">    </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">        </span><span class="n">x</span><span class="p">.</span><span class="n">set_len</span><span class="p">(</span><span class="mi">128</span><span class="p">);</span><span class="w"></span>
<span class="w">    </span><span class="p">}</span><span class="w"></span>

<span class="w">    </span><span class="n">println</span><span class="o">!</span><span class="p">(</span><span class="s">&quot;{:?}&quot;</span><span class="p">,</span><span class="w"> </span><span class="n">x</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="162336261"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336261" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336261">(Apr 02 2019 at 13:57)</a>:</h4>
<p><span class="user-mention" data-user-id="116155">@Jake Goulding</span> What's the output of that (too lazy to compile and test at the moment...)</p>



<a name="162336305"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336305" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336305">(Apr 02 2019 at 13:57)</a>:</h4>
<p>You know about the playground, right? <span aria-label="wink" class="emoji emoji-1f609" role="img" title="wink">:wink:</span></p>



<a name="162336324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336324">(Apr 02 2019 at 13:57)</a>:</h4>
<div class="codehilite"><pre><span></span>[0, 1, 2, 3...]
</pre></div>



<a name="162336429"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336429" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336429">(Apr 02 2019 at 13:58)</a>:</h4>
<p>I did say I was being <strong>lazy</strong>! <span aria-label="stuck out tongue" class="emoji emoji-1f61d" role="img" title="stuck out tongue">:stuck_out_tongue:</span></p>



<a name="162336532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336532">(Apr 02 2019 at 14:00)</a>:</h4>
<blockquote>
<p>the memory is always initialized</p>
</blockquote>
<p>Is this accurate terminology? I'd think that the memory isn't initialized at this point; it just happens to have some values in it from the beforetime.</p>



<a name="162336658"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336658" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336658">(Apr 02 2019 at 14:01)</a>:</h4>
<p>Who are quoting?  If I said that, then I was dead wrong...</p>



<a name="162336825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162336825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162336825">(Apr 02 2019 at 14:03)</a>:</h4>
<p>Just to be completely sure that we're all on the same page: that it's UB to read uninitialized memory does not simply mean that you get some unpredictable string of ones and zeros from whatever was last written there. It is capital-U Undefined Behavior which can have arbitrary and arbitrarily bad consequences, such as running <code>rm -rf /</code> or making demons come out of your nose.</p>



<a name="162337153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337153">(Apr 02 2019 at 14:07)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> To be that level of UB, you'd have to show that you can trigger something that bad just by reading the memory (no writing).  Can you? I don't know of a method of triggering something like <code>rm -rf</code> solely by reading memory, but I could be wrong.  (Some weird trick involving <code>mmap()</code> or <code>/proc</code>? IDK...)</p>



<a name="162337332"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337332" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337332">(Apr 02 2019 at 14:09)</a>:</h4>
<p>That's not how this works. As you said previously, even if everything appears to work fine in test programs, it's still UB because the docs says so. Because it's declared to be UB by the language, if you write and run a program that does it, Rust implementations are free to do whatever with it, including such bad and apparently contrived things.</p>



<a name="162337440"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337440" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337440">(Apr 02 2019 at 14:10)</a>:</h4>
<p>Good point, you're right.  I was jumping ahead and thinking about practical consequences.</p>



<a name="162337517"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337517" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337517">(Apr 02 2019 at 14:11)</a>:</h4>
<p>(That said I actually do have a program in mind that could plausibly wind up running <code>rm -rf /</code> even though under a naive "uninitalized memory is just an unpredictable fixed bit string" it shouldn't)</p>



<a name="162337794"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337794" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337794">(Apr 02 2019 at 14:14)</a>:</h4>
<p>Would that be using safe code only?</p>



<a name="162337829"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162337829" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162337829">(Apr 02 2019 at 14:14)</a>:</h4>
<p>I mean, that is starting to sound like something the secure code working group would want to look into as well...</p>



<a name="162338033"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162338033" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162338033">(Apr 02 2019 at 14:16)</a>:</h4>
<p>Safe Rust can't read uninitalized memory because reading uninitialized memory is UB and safe code is designed to not have UB. You need some unsafe to make the uninitalized memory available. (Or you exploit one of the open soundness issues to do it, but that's not really the point of the exercise.)</p>



<a name="162338206"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162338206" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162338206">(Apr 02 2019 at 14:17)</a>:</h4>
<p>OK, I'm more comfortable with <code>unsafe</code> having this possibility.  Pure safe code should be <em>safe</em> at all times.</p>



<a name="162338412"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162338412" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162338412">(Apr 02 2019 at 14:19)</a>:</h4>
<p>Huh? If reading uninitialized memory wasn't UB, then safe code would be allowed to do it (directly or indirectly). Because all "safe" means is "no UB". Safe code isn't (and shouldn't be) a stand-in for some standard of "security" or "defensive coding" or other meanings of "safe".</p>



<a name="162338413"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162338413" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162338413">(Apr 02 2019 at 14:19)</a>:</h4>
<p>So, are you able to test out your idea and see if this is 'UB' or just 'ub'?</p>



<a name="162338582"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162338582" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162338582">(Apr 02 2019 at 14:21)</a>:</h4>
<p>I agree, 'safe' does not mean 'secure'.  However, from an ergonomics point of view, it does feel like a nice set of training wheels before you hit the big-boy land of <code>unsafe{}</code></p>



<a name="162339316"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162339316" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162339316">(Apr 02 2019 at 14:27)</a>:</h4>
<blockquote>
<p>So, are you able to test out your idea and see if this is 'UB' or just 'ub'?</p>
</blockquote>
<p>The couple variants I tried get optimized out before they reach the point in the optimization pipeline where I would have hoped things go really awry. I was shooting for a similar approach to the C or C++ example that made the rounds a while ago where calling a function pointer that could only be null or one specific function (and which in reality would be null) would call that function instead of crashing.</p>



<a name="162339495"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162339495" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162339495">(Apr 02 2019 at 14:29)</a>:</h4>
<blockquote>
<p>I agree, 'safe' does not mean 'secure'.  However, from an ergonomics point of view, it does feel like a nice set of training wheels before you hit the big-boy land of <code>unsafe{}</code></p>
</blockquote>
<p>That is pretty fundamentally opposed to how safe and <code>unsafe</code> Rust are designed and related. If something can be exposed to safe code without UB (either as primitive or by writing a safe  API that uses <code>unsafe</code> internally) then it <em>should</em> be exposed, to minimize the amount of times people have to use <code>unsafe</code> and open themselves up to even worse than whatever "dangerous" thing we're talking about.</p>



<a name="162341045"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162341045" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162341045">(Apr 02 2019 at 14:42)</a>:</h4>
<blockquote>
<p>That is pretty fundamentally opposed to how safe and <code>unsafe</code> Rust are designed and related...</p>
</blockquote>
<p>I don't think that they are fundamentally opposed.  I agree that 'safe' doesn't mean 'secure', or 'it is impossible to shoot yourself in the foot in safe code'; training wheels don't guarantee that you won't find a way to flip your bike, or prevent getting hit by a truck either.  However, the 'no UB in safe rust' rule <em>is</em> a set of training wheels; the compiler won't let me use uninitialized memory, won't let me overflow buffers, etc.  That makes it easier for new programmers to learn rust; just avoid using <code>unsafe</code> until you have a good idea of what you're doing, and then be really, really careful when using <code>unsafe</code> in your code.</p>



<a name="162342020"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162342020" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162342020">(Apr 02 2019 at 14:50)</a>:</h4>
<p>I guess I have two issues with this angle. The other one is that it casts safe Rust as a kid's playground and unsafe Rust as the thing for Real Programmers. In reality, everyone should minimize their use of unsafe, and IMHO there is no discernible "minimum programming skill" for being allowed to write <code>unsafe</code>, because most conventional measures of programming skill don't correlate well with being able to avoid UB (cf. how highly skilled and experienced C programmers continue to write programs full of UB) and the detailed knowledge being necessary for writing sound <code>unsafe</code> code has practically no overlap with the knowledge necessary to be productive in safe Rust.</p>



<a name="162343089"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162343089" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Cem Karan <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162343089">(Apr 02 2019 at 15:00)</a>:</h4>
<p>I see and agree with your points.  However, for someone that is new to rust, avoiding 'unsafe' is a pretty good first step towards being productive while you're still learning the language.  That's where I'm at right now; I've been programming professionally for about 18 years now, but only just started learning rust this year.  I needed to be productive within 3 <em>days</em> of starting to learn the language; by avoiding <code>unsafe</code> blocks, I got a feel for the borrow checker, and quickly got a better idea of rust's semantics <strong>while still being productive</strong>.  I could have written all of my code inside of <code>unsafe</code> blocks right from the start, but that would have been code that was syntactically rust, but morally equivalent to C code with a lot of void pointers all over the place.  Not a good use of the language.</p>
<p>IMHO, <code>safe</code> vs. <code>unsafe</code> is actually one of the major selling points of rust; it lets you take risks that you can't  in other languages.</p>



<a name="162353592"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162353592" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162353592">(Apr 02 2019 at 17:01)</a>:</h4>
<p>See the pictures in <a href="https://stackoverflow.com/a/51224196/155423" target="_blank" title="https://stackoverflow.com/a/51224196/155423">https://stackoverflow.com/a/51224196/155423</a></p>



<a name="162359007"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162359007" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162359007">(Apr 02 2019 at 18:04)</a>:</h4>
<p>FWIW it is possible to get uninitialized buffers in "safe" code if the unsafe is abstracted away from your code in certain libraries.</p>



<a name="162359012"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162359012" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> nagisa <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162359012">(Apr 02 2019 at 18:04)</a>:</h4>
<p>/me won’t be pointing fingers</p>



<a name="162363950"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading%20uninit%20memory%20%2Ais%2A%20ub%20right%3F/near/162363950" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tom Phinney <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/reading.20uninit.20memory.20*is*.20ub.20right.3F.html#162363950">(Apr 02 2019 at 18:58)</a>:</h4>
<p>UB is a compiler-writer concept that is intended to circumscribe those aspects of programming where the compiler is not required to uphold the programmer's expressed intentions. In other words, compiler optimizations are permitted – one might almost say encouraged – to screw up all code that contains any amount of UB. rustc attempts to prove to itself that code is not UB, aborting compilation when it fails to complete those proofs. <code>unsafe</code> is simply a compiler keyword via which a programmer tells the compiler that the programmer has taken on a limited part of that proof responsibility.  If the programmer lies, or simply is wrong, and UB is actually present, then any compiler guarantees about realizing the programmer's intent are null and void.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>